STstreamkap
Project Keys

Update Project Key

Changed on

Update a Project Key's name, description, roles, tool scoping, or Kafka ACLs.

Supports additive capability transitions:

  • Send kafka_config on an API-only PK to add Kafka access. Response will include new_kafka_credentials with the plaintext Kafka password (shown once).
  • Send role_ids or permission_ids on a Kafka-only PK to add API credentials. Response will include new_api_credentials with the plaintext client_secret (shown once).

Returns 400 if the key is in creating/deleting/delete_failed state. role_ids and permission_ids are mutually exclusive.

patch/project-keys/{project_key_id}

Request

Path parameters

project_key_idstring required

Request body

namestring nullable

Updated name

descriptionstring nullable

Updated description (HTML sanitized)

role_idsstring[] nullable

Change the Frontegg roles for this PK, or assign roles when adding API access to a Kafka-only PK. Note: changing roles on an existing API credential only takes effect when the current JWT expires. See token_ttl_seconds in the detail response for the validity window.

permission_idsstring[] nullable

Assign fine-grained permissions when ADDING API access to a Kafka-only PK. Changing permissions on an existing API credential is NOT supported - to change permissions on an existing PK, either switch to role_ids or delete and recreate the PK. This field is only accepted when the PK has no api_client_id yet.

whitelist_ipsstring nullable
kafka_passwordstring nullable

Rotate the Kafka SASL password for an existing Kafka user. PK must have kafka_username.

tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable

Response

Successful Response

idstring required
namestring required
descriptionstring nullable
created_atstring date-time nullable
api_client_idstring nullable
api_client_id_masked_secretstring nullable
kafka_usernamestring nullable
service_idstring required
statusstring required
last_used_atstring date-time nullable
tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable
agentic_enabledboolean

Whether this Project Key is enabled as the credential for the Streamkap MCP server. Toggled via POST /project-keys/{id}/enable-agentic and disable-agentic. When true, Streamkap stores the encrypted credential server-side; only enabled keys can be picked for agents.

agentic_secret_blobstring nullable

Always masked to '********' on responses when agentic_enabled is true; null otherwise. Server-derived only - PUT/PATCH bodies that include this field are rejected with 422.

token_ttl_secondsinteger

Current Frontegg JWT TTL in seconds (dynamic). Role changes take up to this long to propagate.

warningsstring[]

Non-blocking informational messages to show the user after the update (e.g. 'role changes take effect within X hours'). Empty list when there is nothing to warn about.

Changes

  • 50e54c2e65f2Revision changes
    • info

      the response's property default value 21600 was added for the status

  • 2a3df099f4a9Revision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status